Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2024, 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
- Size 73KB
- Sample240809-w77gyaxglc
- SHA256 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32
- MD5 c9c2358907648d44fee6ed45028ea77b
- SHA1 81b39afed89f7227657dfa9245e08e38dd273194
- SHA512 7840fe1ea4c40e0662cb49238cacc5d0bc6751881a606bec9d7afd2a87fd0cd1ebb2838dc2983850d4627af036d63ecfc45d390895b97cc8685d107212f0f943
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEO:/7ZQpApze+eJfFpsJOfFpsJ5Ddu7ey
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe"C:\Users\Admin\AppData\Local\Temp\0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp
- Size 73KB
- SHA256 1e8e9efca53dc251d445204719708bf326bfb85c583223cab846eb4f0c8a6f25
- MD5 4783594cf64b4e81d4ffebfd9e1e8e08
- SHA1 a89751bd53d2a6d25125c0f2495bb335fade27a7
- SHA512 9b3862c376565e95adf9e2d5971b4b39814d6d7f77b4951f708be8aa85a88c3154d562ae169303021a1af63638c794612c8e1471e57c49c2d859d2d5f59736bd
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEJ:/7ZQpApze+eJfFpsJOfFpsJ5Ddu7eCK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 172KB
- SHA256 4455baed4363e4c5940374e79883d36c9e3db5dc4ec6425ec1633f0bd8fe4c9b
- MD5 28d2816f13cf60961ec12e2da2c6f461
- SHA1 90ace6cd11b7e9feb0203227646f330f55a0b0f0
- SHA512 318ddd0961817301cb470a981b7f89feed72288e90e0138a730efbc2307f242c443a1af0a7563e56eebc2876ae06cded30bc22347243ad5e36e20145c5198134
- SSDEEP 3072:9QWpze+eJfFpsJOfFpsJ5Ddu7ePWHIjN3tj6qnv0b2UrXkbvLS:Lpe+ewDdufIjNDv0bNXkbvLS
- MD5 SHA1 SHA512 SSDEEP